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THREATS  TO  PANAMA'S  DEMOCRACY  AND  US  INTERESTS:  A  FRAMEWORK  FOR 
INTELLIGENCE  COLLECTION  AND  ANALYSIS 

A.  Introduction  and  Purpose 

The  purpose  of  this  study  is  to  develop  a  framework  for 
analysis  of  the  threats  confronting  the  newly  established  Panamanian 
government,  as  well  as  US  personnel  and  facilities  in  Panama. 
Although  political  change  may  occur  through  democratic  and  non¬ 
democrat  ic  means,  this  study  seeks  to  develop  a  model  for  assessing 
the  likelihood  that  non-democratic  means  of  change  will  threaten 
Panama.  To  that  end,  economic,  political,  and  social  determinants 
must  first  be  analyzed  to  isolate  the  conditions  under  which  these 
threats  are  likely  to  emerge.  The  framework  can  then  be  applied  to 
formulate  strategic,  operational,  and  tactical  intelligence 
requirements  to  guide  collection  efforts  and  intelligence  analysis. 

Although  the  United  States  seeks  to  ensure  that  political 
change  in  Panama  occurs  through  democratic  processes  such  as 
elections,  legislative  actions,  and  judicial  review,  the  Panamanian 
government  may  also  be  faced  with  groups  that  seek  non-democratic 
change.  Non-democratic  change  can  be  achieved  through  violent  means, 
such  as  coups,  revolutions,  or  terrorism,  or  through  non-violent 
means,  such  as  bribery,  strikes  or  exclusionary  politics.  Non¬ 
violent  actions  can  provide  a  direct  stimulus  for  change,  or  they  can 
lead  to  violent  actions  which  cause  a  change.  A  vicious  cycle 
between  the  two  often  results,  in  which  a  peaceful  strike  leads  to  a 
violent  demonstration,  which  itself  provokes  further  non-violent  acts 
as  popular  support  increases. 
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Both  democratic  and  non-democratic  changes  can  affect  the 
structure,  the  personalities  or  the  policies  of  a  government.  A 
revolution  is  an  example  of  a  structural  change  which  alters  the 
nature  of  the  regime.  Personality  changes  can  result  from  coups  or 
assassinations,  which  replace  the  people  in  government,  but  do  not 
transform  the  regime.  Policy  changes  occur  when  a  government's 
action  policy  shifts,  sometimes  in  concert  with  its  declaratory 
position.  These  changes  may  occur  independently  of  each  other  or 
s imul taneously . 

Therefore,  to  assess  the  threat  posed  to  the  Panamanian 
government  and  US  interests  in  Panama,  the  analyst  must  determine 
which  type  of  change  is  most  likely,  how  it  will  be  achieved,  and  the 
political  objective  of  the  change. 

B.  DETERMINANTS  OF  INSTABILITY:  ECONOMIC,  POLITICAL,  SOCIAL 

The  first  step  in  intelligence  collection  and  analysis  is  to 
assess  the  prospects  for  political  change  and  instability  determined 
by  the  economic,  political,  and  social  conditions  of  the  country. 
Perceived  inequities  in  any  of  these  areas  can  lead  to  an  environment 
that  fosters  and  facilitates  non-democratic  change. 

This  section  offers  a  framework  for  the  collection  and  analysis 
of  information  necessary  to  analyze  the  economic,  political,  and 
social  determinants  of  instability.  It  is  not  complete;  experience 
will  indicate  which  requirements  should  be  added  or  eliminated,  and 
collection  requirements  may  differ  for  various  levels  of  analysis. 
It  is  also  not  static;  the  environment  constantly,  and  these 
changes  must  be  continuously  monitored  to  determine  their  effect  on 
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the  current  situation  and  the  possible  events  resulting  from  these 
changes . 

1.  ECONOMIC 

Economic  conditions  may  reflect  the  potential  for  threats 
ranging  from  revolutionary  insurgency  or  a  coup  d'etat  to 
narcotrafficking.  Revolution  is  often  most  likely  when  a  wide 
discrepancy  develops  between  societal  expectations  and  achievements, 
as  when  long  periods  of  economic  prosperity — for  society  as  a  whole 
or  for  only  certain  groups — are  followed  by  a  sharp  period  of 
decline.  Or,  conversely,  the  same  result  may  occur  when  society's 
expectations  about  economic  improvement  after  long  periods  of  decline 
are  left  unfulfilled.  Opposition  groups  can  easily  exploit  such 
discontent  and  perceived  deprivation. 

Some  of  the  economic  indicators  of  political  instability 
include: 

— Are  society's  economic  expectations  satisfied? 

— Did  a  sharp  decline  follow  a  period  of  relative 
prosperity? 

— What  is  the  level  of  unemployment  and  which  groups  are 
most  affected? 

— Are  there  opportunities  for  advancement  open  to  all 
groups? 

— What  is  the  inflation  rate? 

— Does  a  small  elite  own  most  of  the  property? 

— Can  the  government  fulfill  the  basic  economic  needs  of 
society? 

— Are  there  viable  alternatives  available  to  those  who 
grow  illicit  crops? 

— Is  the  economy  dependent  on  the  drug  industry? 
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— What  is  the  level  and  pace  of  modernization  and 
development?  Are  some  groups  left  behind? 

2.  POLITICAL 

Political  conditions  also  shape  the  potential  for  non¬ 
democrat  ic  change.  For  example,  political  violence  can  erupt  when 
the  existing  political  structure  does  not  accommodate  the  interests 
of  newly  developed  political  groups.  In  these  cases  the  process  of 
social  and  economic  change  often  outpaces  political  modernization  and 
development.  The  political  legitimacy  of  the  target  government  is 
often  attacked,  and  revolutionary  insurgency  may  be  regarded  as  a 
form  of  political  competition.  Exclusionary  politics,  government 
rule  by  oligarchy  that  leads  to  disenfranchisement  of  particular 
classes,  minorities,  or  any  other  group,  is  itself  a  threat  to 
democracy  and  can  also  fuel  political  frustration.  Finally, 
terrorism  may  also  become  more  likely  under  political  conditions  that 
allow  terrorist  groups  to  undermine  citizens'  faith  in  government  and 
morale,  thereby  hastening  the  political  collapse  of  society.  A 
terrorist  may  also  seek  to  provoke  the  government  into  overreacting, 
thus  creating  an  authoritarian  police  state. 

Key  political  indicators  of  political  instability  include: 

— Legitimacy 

Do  certain  groups  challenge  the  legitimacy  of  the  ruling 
power  ? 

Are  specific  individuals  and  policies,  or  the  regime 
itself,  criticized? 

— Openness  of  the  political  process 

Can  the  system  adapt  to  accommodate  the  interests  of 
emerging  political  groups? 

Is  the  system  open  to  the  participation  of  every 
interest  group,  or  is  the  process  manipulated  by  a 
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powerful  few? 

Do  structural  obstacles,  such  as  voting  laws,  exclude 
certain  groups? 

Are  fair  elections  conducted  on  a  regular  basis, 
according  to  law? 

Are  the  major  branches  of  government  fairly  represented 
by  a  cross  section  of  the  population,  or  does  one  group 
seem  to  dominate? 

— Government  Competence  and  Integrity 

Are  elected  officials  noted  for  nepotism  and  political 
favoritism? 

Are  conflicts  of  interest  prevalent? 

Is  bribery  commonplace?  If  so,  is  it  practiced  for 
personal  gain  or  political  influence? 

Does  the  government  tolerate  illegal  activities,  such  as 
narcotrafficking? 

Can  the  government's  intelligence  service  and  police 
forces  penetrate  terrorist  and  subversive  organizations, 
foil  attacks,  and  mount  successful  counterterrorist 
operations  without  the  perception  of  overreacting,  thus 
alienating  the  public? 

— Political  Culture 

Are  coups  and  revolutions  prevalent  in  the  society's 
history  and  political  culture? 

3.  SOCIAL 

Prevailing  social  conditions  comprise  the  final  category  of 
variables  that  affect  political  instability.  Conditions  such  as 
class  structure,  cultural  norms,  and  popular  discontent  influence  the 
degree  and  nature  of  political  violence.  The  role  of  public 
perception  is  particularly  important.  Even  in  the  absence  of  any 
real  societal  grievances,  the  public  perception  of  such  difficulties 
often  independently  provokes  hostility  against  the  government,  which 
may  be  exploited  by  the  opposition. 
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Social  conditions  which  may  incite  political  instability 
include: 

— Are  there  real  or  perceived  political  or  economic 

"causes"  which  terrorist  and  other  subversive  movements 
may  exploit? 

— What  is  the  class  structure  of  the  society?  Does  one 
class  resent  another  for  any  reason? 

— Do  the  local  cultural  and  religious  norms  legitimize 
violence  as  a  means  of  political  change? 

— Which  social  institutions — such  as  family,  the  church, 
etc., — shape  society's  political  attitudes? 

— Is  politics  driven  more  by  personal  appeal  or 
ideological  preference? 

— What  is  the  level  of  government  repression? 

4.  ANALYSIS  OF  THE  DETERMINANTS 

When  applied  to  a  specific  case,  the  economic,  political,  and 
social  determinants  of  political  instability  described  above  should 
not  be  analyzed  independently  of  each  other  and  must  be  evaluated  in 
terms  of  the  local  political  culture.  Depending  on  local  conditions, 
some  indicators  will  become  more  important  than  others,  and  some  may 
not  apply  at  all.  For  example,  some  degree  of  corruption  probably 
plagues  every  government.  In  some  cases,  it  might  even  be  an 
accepted  norm.  To  assess  whether  such  a  practice  poses  a  threat  to 
the  political  stability  of  a  country,  the  analyst  must  determine  how 
this  behavior  is  perceived  by  the  public  and  whether  it  interferes 
with  the  functioning  of  government. 

5.  PRELIMINARY  JUDGMENTS:  THE  DETERMINANTS  APPLIED  TO  PANAMA 

At  this  point  we  believe  that  low-level  terrorism  poses  the 
most  probable  threat  to  the  new  government  in  Panama.  Little 
organization  or  training  is  necessary  to  attack  unprotected  targets 
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of  opportunity.  Terrorists  may  wish  to  exploit  public  discontent 
with  the  slow  pace  of  rebuilding  the  economy  and  create  the 
impression  of  the  government's  inability  to  respond.  Both  American 
and  Panamanian  unprotected  targets  probably  will  probably  remain  at 
risk. 

The  risk  of  other  threats  to  the  government  of  Panama — 
including  more  serious  forms  of  political  violence — probably  will 
remain  low  in  the  near  term.  The  disorganization  and  defeat  of  pro- 
Noriega  forces  in  the  wake  of  Operation  Just  Cause  is  likely  to 
continue  to  paralyze  the  opposition.  If  the  economic  situation  does 
not  improve,  the  opposition  is  likely  to  exploit  growing  public 
frustration  and  blame  the  new  government,  as  these  forces  attempt  to 
reorganize  and  rebuild  themselves. 

Any  threat  to  Panama's  political  stability  must  be  analyzed  in 
terms  of  the  country's  history  and  political  culture.  The  history  of 
coups  and  exclusionary  politics  in  Panama  suggests  that  non- 
democratic  means  of  change  are  readily  available  should  the 
democratic  government  fail.  The  appeal  of  nationalism  for  building  a 
political  consensus  is  also  historically  prevalent  and  may  be 
exploited  by  groups  which  pose  a  threat  to  the  government. 

Once  these  economic,  political,  and  social  determinants  are 
believed  to  exist  in  Panama,  the  analyst  may  then  apply  the  following 
model  to  assess  the  threat  and  help  to  predict  and  explain  events. 


C.  THE  MODEL 

Once  the  above  economic,  political,  and  social  determinants  of 
instability  indicate  conditions  that  foster  non-democrat ic  actions 
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against  the  legitimate  government,  disaffected  members  of  the 
population  are  likely  to  seek  out  or  form  organizations  that  support 
their  personal  objectives.  These  groups  may  use  violent  or  non¬ 
violent  means,  or  both,  to  achieve  their  organizational  goals.  The 
purpose  of  this  model  is  to  assess,  predict,  and  explain  these 
threats  to  democratic  government. 

Threats  to  democratic  government  are  rational  acts  that  can  be 
predicted  through  the  use  of  proper  intelligence  techniques. 
Discontented  with  the  current  political  situation,  organizations  may 
seek  to  change  the  structure,  personalities,  or  policies  of  a 
government  through  non-democratic  means.  The  actions  taken  by  the 
organization  will  usually  be  consistent  with  the  group's  ultimate 
political  objectives. 

The  following  cyclical  model  is  based  in  part  on  this 
rationale.**  Non-democratic  actions,  either  violent  or  non-violent, 
can  be  divided  into  four  distinct  phases:  Organizational,  Pre- 
Incident,  Incident,  and  Post-Incident. 


**This  model  was  adapted  in  part  from  the  terrorist  incident  model  in 
the  unpublished  manuscript,  "Winning  the  Violent  Peace:  Special 
Operations  Short  of  War,"  by  Colonel  Peter  J.  Shoomaker,  USA, 

Research  Associate,  National  Defense  University,  June  1989. 
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Within  each  of  the  phases,  specific  actions  are  taken;  however,  the 
actions  may  or  may  not  occur  sequentially  within  each  phase,  and 
every  action  may  not  apply  to  every  threat  scenario. 

1.  THE  ORGAN I Z AT I ON Mj  PHASE 

The  organizational  phase  refers  to  the  formation  of  a  group  of 
persons  who  share  common  political  objectives.  The  group  or 
organization  is  the  vehicle  used  to  achieve  common  goals.  It  will 
remain  active  as  long  as  it  can  recruit  members  wl-o  share  the  same 
political  beliefs  or  until  all  of  its  objectives  have  been  achieved. 
When  the  organization  chooses  to  pursue  its  goals  through  non- 
democratic  means,  the  group  becomes  a  threat  to  freely  elected 
governments . 

The  organizational  stage  also  applies  to  the  formation  of 
select  cells  within  the  organization  to  carry  out  specific  acts — 
either  violent  or  non-violent — against  the  government.  The  actions 
of  this  cell  almost  always  support  the  group's  objectives,  and  the 
recruitment  of  persons  for  the  cell  will  generally  come  from  within 
the  parent  organization.  A  select  cell  can  be  organized  to 
accomplish  a  specific  task — staging  a  one-time  work  stoppage — or  to 
perform  a  permanent  function — preparing  all  propaganda  for  the 
organization. 

The  analysis  of  information  in  the  organizational  phase  is 
essentially  the  determination  of  the  order  of  battle.  The  techniques 
for  collecting  this  information,  however,  differ  markedly  from  those 
used  to  assess  the  capabilities  of  a  conventional  enemy.  Human 
intelligence  (HUMINT)  is  by  far  the  most  useful  method.  Since 
clandestine  subversive  organizations  do  not  extensively  use 
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electronic  communications,  and  do  nor.  move  obtrusively  large  types  of 
equipment,  signals  and  photographic  intelligence  are  of  limited 
value. 

The  threat  of  the  organization  is  determined  not  only  by  the 
size  of  its  membership,  but  also  by  the  social,  religious, 
professional,  ana  kinship  relationships  of  the  organization's  active 
membership.  The  active  members'  circle  of  friends,  family,  and  work 
associates  will  determine  the  potential  size  and  capability  of  the 
organization.  For  example,  a  three  man  organization  may  pose  little 
military  threat.  However,  the  three  members  may  represent  the  view 
of  hundreds  of  people  who,  though  unwilling  to  provide  the  group 
active  support,  will  not  report  it  to  governmental  authorities.  The 
group  then  would  have  the  freedom  to  recruit  and  persuade  others  to 
join  its  cause.  Left  unattended  because  the  initial  analysis 
indicate^  no  military  threat,  the  organization  can  grow  in  size  and 
capability  to  challenge  legitimate  government's  authority. 

As  a  new  group  matures,  and  its  size  grows,  the  organizational 
focus  may  shift  from  mobilizing  internal  support  to  consolidating  its 
membership.  Wnile  in  the  embryonic  stages,  the  group  may  be  very 
small  and  loosely  organized  without  a  strong  leadership.  As  the  size 
of  the  group  increases,  however,  the  organization  may  become  more 
structured  as  the  leadership  attempts  to  increase  its  control  over 
the  membership.  The  group  may  also  choose  to  unite  with  oth^r 
organizations  that  share  similar  goals  to  form  a  coalition.  Such  an 
umbrella  organization  is  often  able  to  exert  more  pressure  on  the 
government,  but  is  also  more  vulnerable  to  factionalism. 

2.  PRE-TNCIDENT  PHASE 
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Once  an  organization  has  been  formed  and  a  political  objective 
has  been  chosen,  the  group  then  determines  the  means  it  will  use  to 
pursue  its  goals.  Whether  the  means  chosen  are  violent  or  non¬ 
violent,  the  organization  is  likely  to  follow  a  general  sequence  of 
preparation: 

1.  Select  potential  targets/events. 

2.  Develop  the  logistical  network  and  infrastructure  to 
support  operations. 

3.  Plan,  train,  and  rehearse  the  event. 

4.  Pre-position  operatives  and  equipment. 

5.  Move  to  the  target/event  location. 

a.  Selecting  a  Target  or  Event 

An  organization  will  choose  a  target  or  evei  t  based  on  the 
group's  capabilities.  Newly  formed  groups,  for  example,  with  little 
training,  experience  and  materiel,  are  likely  to  attack  unprotected 
targets  using  relatively  unsophisticated  methods — such  as  throwing 
hand  grenades.  Established  organizations  may  select  higher  profile, 
protected  targets  that  require  sophisticated  casing  and  assessing, 
and  more  complex  techniques,  such  as  the  use  of  remotely  detonated 
devices. 

The  group  will  also  select  targets  which  support  the 
organization's  strategic  and  tactical  objectives.  The  tactical  goal 
of  many  groups,  especially  those  in  the  early  stages  of  development, 
is  to  attract  public  attention  to  its  cause  and  to  gain  popular 
support.  The  strategic  objective  of  the  organization  will  vary 
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according  to  the  political  objectives.  The  targets,  however,  will  be 
consistent  with  these  objectives. 

Finally,  the  target  will  also  be  chosen  in  an  attempt  to 
influence  a  particular  audience  that  is  often  different  than  and 
broader  than  the  immediate  object  of  the  action. 

b.  Developing  the  Logistical  Infrastructure  to  Support  Operations 

The  activities  of  the  organization's  logistical  support 
network,  which  depend  on  the  sophistication  of  the  planned  operation, 
make  the  group  vulnerable  to  detection  during  this  phase.  The 
procurement  of  arms,  explosives,  vehicles,  and  safehouses,  for 
example,  requires  contacts  with  non-group  members,  thus  increasing 
the  number  of  persons  who  have  some  knowledge  of  the  operation,  which 
heightens  the  risk  of  detection. 

c.  Planning,  Training,  and  Rehearsing 

During  this  stage  of  planning,  training,  and  rehearsing, 
organizations  are  generally  most  vulnerable  to  compromise.  While  the 
level  of  this  preparation  depends  on  the  complexity  of  the  operation, 
in  this  phase  most  participants  will  be  informed  of  the  plan  and  the 
roles  they  are  to  play.  Thus,  at  this  point,  the  greatest  number  of 
persons,  from  both  within  and  outside  the  group,  will  have  at  least 
some  knowledge  of  the  operation. 

d.  Pre-Positioning  of  Personnel  and  Equipment 

As  in  the  previous  stages,  the  level  of  activity  during  this 
phase  depends  on  the  complexity  of  the  planned  event.  For  violent. 
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low-level  actions  against  unprotected  targets,  such  as  throwing  a 
hand  grenade  into  a  crowded  restaurant,  or  non-violent  actions,  such 
as  strikes  and  demonstrations,  this  phase  is  likely  to  be  brief,  and 
possibly  spontaneous.  In  more  sophisticated  operations,  however, 
such  as  attacking  a  well  protected  embassy,  leaders  may  be  required 
to  move  participants  and  equipment  from  various  training  siter  \nd 
safehouses,  which  again  increases  the  risk  of  detection. 

e.  Movement  to  Target 

During  this  phase,  participants  are  often  required  to  commit 
illegal  acts  which  endanger  the  group  members  and  puts  the  operation 
at  risk.  Participants  are  forced  to  leave  their  safehouses  and 
safehavens  to  move  to  the  area  of  operations.  At  this  point  they 
also  must  frequently  break  the  law  by  possessing  illegal  firearms, 
false  documents,  or  stolen  vehicles,  for  example.  Participants  in 
non-violent  acts,  though  still  required  to  enter  the  area  of 
operations  and  thus  expose  themselves  to  surveillance  and 
questioning,  generally  do  not,  at  this  point,  commit  illegal  acts. 

3.  INCIDENT  PHASE 

In  the  incident  phase,  the  group  actually  executes  its  plan, 
the  success  of  which  is  the  ultimate  measure  of  the  group's 
capabilities.  To  accomplish  its  objective,  the  group  must  gain 
access  to  the  target,  takeover  the  target,  and  then  terminate  the 
action  on  grounds  favorable  to  the  organization.  Obviously,  during 
this  critical  phase,  several  imponderables  may  intervene  to 
jeopardize  the  operation.  Security  forces  should  be  alert  and 
prepared  to  exploit  these  opportunities. 
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4.  POST-INCIDENT  PHASE 

During  this  phase  the  group  must  focus  on  escaping  the  area  of 
operations  and  returning  to  its  safehaven,  which  again  makes  the 
group  vulnerable  to  detection.  After  a  low-level  attack  on  an 
unprotected  target,  an  escape  is  usually  relatively  easy  to 
accomplish.  Return  to  the  safehavens  after  non-violent  acts  is  also 
relatively  uncomplicated,  especially  when  illegal  acts  were  not 
committed.  In  the  case  of  a  sophisticated  operation  against  a 
protected  target,  a  return  to  the  safehaven  becomes  more  difficult 
and  may  depend  on  outside  assistance  from  a  state  sponsor  or 
negotiations  with  the  target  government. 


D.  COLLECTION  PLAN  AND  GUIDE  TO  ANALYSIS 

The  following  collection  plan  and  analysis  guide  seek  to  both 
predict  and  explain  threats  to  the  stability  of  the  Panamanian 
government  and  US  interests  in  Panama.  Phases  one  and  two,  the 
organizational  and  pre-incident  stages,  are  predictive,  as  the 
analyst  develops  a  list  of  possible  threats,  and  then  a  more  detailed 
assessment  of  the  most  probable  of  these.  This  portion  of  the  guide 
is  also  explanatory,  for  the  analyst  can  use  the  model  to  assess 
incidents  that  have  already  occurred. 

Phases  three  and  four,  the  incident  and  post-incident  stages, 
illustrate  the  cyclical  nature  of  the  model — what  is  essentially  an 
explanation  of  a  past  incident  may  serve  as  input  for  predicting 
events  in  the  future.  These  final  two  phases  assist  the  analyst  in 
assessing  an  event  after  it  has  occurred.  This  analysis,  however, 
then  itself  becomes  valuable  information  that  can  be  rechanneled  into 
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the  organizational  and  incident  phases  to  help  predict  future 
threats. 

1.  Organizational  Phase 

PIR:  What  groups  or  organizations  pose  a  threat  to  the 

Panamanian  government  or  US  interests  in  Panama? 

a.  What  organizations  are  known  to  exist? 

b.  What  are  the  objectives  of  these  organizations? 

strategic  vs.  tactical  objectives 
stated  vs.  real  objectives 

c.  What  are  the  capabilities  of  these  organizations? 

funding 

equipment 

training 

outside  support  from  states  or  organizations 
popular  support 

d.  Who  are  the  members  of  the  organizations  that  pose  a 
threat? 

known  leaders  and  members 

kinship,  religious,  PDF,  social  ties 

ties  to  foreign  governments 

e.  What  links  exist  among  groups  and  group  members? 

common  objectives 
covert/overt  ties 

Organizational  Phase  Analysis 

The  first  step  in  determining  which  organizations  pose  a  threat 
to  the  Panamanian  government  or  to  U.S.  interests  in  Panama  is  to 
identify  all  possible  clandestine  and  overt  political  organizations. 
The  analyst  must  list  every  possibility,  and  then  eliminate  those 
that  do  not  pose  a  threat,  which  is  determined  by  assessing  the 
capabilities  and  intentions  of  the  organizations.  Since  stated 
objectives  may  differ  from  actual  objectives,  the  analyst  must 
compare  organizational  actions  with  organizational  objectives  to 
discover  the  true  goals  of  the  group. 
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Capabilities  of  an  organization  include  access  to  resources, 
such  as  funds  and  materiel,  as  well  as  less  tangible  resources,  such 
as  popular  support  and  experienced  planners.  If  the  goals  of  an 
organization  do  not  support  non-democratic  change  and  it  has 
extremely  limited  capabilities,  then  it  probably  poses  little  threat. 
Conversely,  organizations  with  objectives  explicitly  advocating 
violent  or  other  non-democratic  acts  against  the  government  of  Panama 
or  U.S.  interests  pose  a  real  threat,  and  significant  capabilities 
only  enhance  that  threat.  The  stated  objectives  of  an  organization 
should  not  be  disregarded  because  the  group  apparently  lacks  the 
capability  to  conduct  operations  in  pursuit  of  its  goals. 

After  assessing  the  objectives  and  the  capabilities  of  these 
organizations,  the  result  should  be  a  prioritized  list  of  possible 
threats.  Next,  the  analyst  must  attempt  to  identify  the  known  members 
of  each  organization,  especially  the  organizational  leaders.  The 
search  for  group  members  should  include  kinship,  religious,  and 
social  ties.  The  extended  family  is  common  in  Panamanian  culture, 
and  often  includes  distant  relatives  and  godchildren.  Ties  to  the 
PDF  are  also  important,  and  the  tendency  for  PDF  officers  to 
associate  with  graduates  of  the  same  military  academy,  for  example, 
could  lead  to  further  connections.  Identification  of  known  members 
can  help  in  focusing  surveillance  and  discovering  safehouse 
locations,  training  and  staging  areas,  and  possibly  even  targets. 

The  last  step  is  to  identify  links  among  groups.  Dual 
membership  in  threatening  and  non-threatening  organizations  can 
indicate  hidden  ties.  Groups  may  pursue  a  united  front  strategy  to 
attract  members  from  different  groups  with  various  political  agendas 
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to  gain  widespread  support  and  the  aura  of  legitimacy.  Evaluation  of 
these  linkages  might  also  lead  to  the  discovery  of  additional 
capabilities  that  increase  the  threat  posed  by  an  organization. 

This  portion  of  the  analysis  narrows  the  number  of 
organizations  to  those  that  have  non-democratic  objectives  and  some 
capability  to  support  actions  to  pursue  their  goals,  and  in  this 
sense,  is  predictive.  The  model  can  be  explanatory  as  well,  as  the 
analyst  examines  a  previously  committed  act  and  tries  to  explain  it 
in  terms  of  organizational  objectives  and  capabilities.  Each  event 
provides  input  that  requires  objectives  and  capabilities  to  be 
reevaluated  and  perhaps  the  threat  list  to  be  reordered. 

2.  PRE-INCIDENT  PHASE 
Target  Selection 

PIR:  What  are  the  most  likely  audiences,  targets,  and 
tactics? 

a.  What  audiences  can  be  influenced  to  achieve  the 
group's  objectives? 

b.  What  are  the  tactical,  short-term  goals  of  the  group? 

media  attention  for  the  "cause" 
mobilization  of  popular  support 

c.  What  kinds  of  acts  are  likely  to  achieve  the 
objectives  and  influence  the  audience? 

violent  vs.  non-violent 
capabilities  of  the  group 

d.  What  targets  can  influence  the  audience? 

e.  How  secure  is  the  target? 

protected  vs.  unprotected 

Target  Selection  Analysis 

The  determination  of  the  target  audience  is  a  critical  step  in 
predicting  and  analyzing  target  selection.  Often  the  immediate 
target  of  an  event  is  different  than  the  target  audience  the  group 
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seeks  to  influence.  For  example,  US  military  personnel  stationed 
abroad  may  become  the  targets  of  political  violence  in  an  attempt  to 
force  the  United  States  to  withdraw  from  that  country.  In  this  case, 
the  immediate  victims  are  the  US  personnel  attacked,  but  the  target 
audience  the  group  seeks  to  influence  is  US  public  opinion  and  US 
government  policy. 

This  analysis  also  applies  to  the  conditions  in  Panama.  If  the 
objective  of  an  organization  is  to  force  the  withdrawal  of  US  troops, 
then  the  analyst  must  identify  the  audience  capable  of  influencing 
events  to  achieve  this  goal.  Knowing  the  pressure  that  public 
opinion  exerts  on  American  politics,  groups  may  select  targets  in 
Panama  that  will  influence  public  or  political  opinion  in  the  United 
States.  Thus,  the  analyst  must  examine  the  goals  of  the 
organization,  decide  which  audience  can  best  achieve  these  goals,  and 
then  identify  targets  that  can  influence  this  audience. 

In  addition  to  their  strategic  objectives,  groups  may  pursue 
short-term,  tactical  goals  that  may  directly  or  indirectly  support 
their  broader  political  aims.  Propaganda  and  demonstrations  may  be 
used  to  gain  popular  support  for  a  cause,  rather  than  to  effect  a 
direct  change  in  policy.  Terrorist  acts  may  also  be  committed  to 
publicize  the  group's  cause,  to  instill  disorder  in  society,  or  to 
provoke  a  government  into  taking  repressive  countermeasures.  Some 
groups  may  even  wish  to  claim  attacks  it  did  not  commit  in  order  to 
create  the  perception  of  enhanced  capabilities  and  to  attract  popular 
support.  Such  changes  in  the  societal  environment  may  create  a 
situation  more  conducive  to  achieving  the  group's  goals.  Finally, 
some  organizations,  especially  those  in  the  embryonic  stages,  may 
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commit  acts  merely  to  demonstrate  that  they  possess  the  capability, 
in  order  to  attract  support  from  other  organizations  or  state 
sponsors . 

An  analysis  of  the  group’s  objectives  and  capabilities  will 
also  enable  the  analyst  to  better  predict  and  assess  the  types  of 
acts  that  may  be  committed.  The  effect  of  the  act  on  the  target 
audience  must  be  considered  in  conjunction  with  the  goals  of  the 
group.  Violent  acts  may  alienate  the  general  population  which  the 
group  is  seeking  to  influence,  or  strengthen  the  resolve  of  the 
audience  not  to  succumb  to  the  group's  demands.  Conversely,  non¬ 
violent  acts  may  be  viewed  as  ineffective  and  weak,  or  as  an 
indication  that  the  group  is  incapable  of  committing  violence. 
Embryonic  groups  with  little  capability  are  most  likely  to  seek  the 
publicity  of  a  high-profile,  violent  attack  against  an  unprotected 
target  using  relatively  unsophisticated  tactics.  Depending  on  their 
political  objectives  and  the  audience  they  seek  to  influence,  groups 
with  more  sophisticated  capabilities  are  more  likely  to  attack 
protected  targets. 

Logistical  Support 

PIR:  What  indications  suggest  that  an  act  or  event  is 
being  planned? 

a.  What  actions  indicate  increased  procurement  of  money, 
arms,  explosives  and  other  supplies? 

bank  transfer  activity 
discovery  of  arms  caches 
property/equipment  rentals 

any  evidence  of  illegal  activity  to  obtain  this 
material 

transport  capability 

b.  Has  there  been  increased  activity  at  safehouses  or 
other  areas  where  the  group  is  known  to  be  present? 

increased  number  of  persons  entering  and  exiting 
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communications  via  telephone  or  other  means 
travel  to  safehavens  provided  by  state  sponsors 

c.  Have  there  been  incidents  of  lost,  stolen,  or 
counterfeit  documents? 
passports 
visas 

identification  cards 
Logistical  Support  Analysis 

Information  on  activities  conducted  to  provide  logistical 
support  can  offer  clues  to  the  group's  intended  tactics  and  serve  as 
an  early  warning  device  as  well.  Increased  procurement  of  arms, 
explosives  or  other  supplies  could  indicate  that  a  group  is  gathering 
the  tools  necessary  to  take  action.  The  equipment  being  procured 
should  indicate  the  type  of  act  or  event  that  is  being  planned. 
Printing  presses  or  mimeograph  machines,  for  example,  would  be  useful 
in  a  propaganda  campaign.  Criminal  activity  is  an  especially 
significant  indicator  when  it  involves  contraband,  money  or  strictly 
controlled  items. 

Additional  transport  capability  acquired  by  a  group  could 
indicate  several  possibilities.  Perhaps  the  group  is  larger  than 
originally  estimated  to  be,  or  has  recently  added  new  members, 
resulting  in  increased  capability.  It  could  also  signal  that  an 
operation  is  being  planned,  indicating  a  high  level  of  sophistication 
for  violent  acts  that  require  coordination  among  many  persons. 

Incidents  involving  falsified  or  stolen  documents  may  also 
reveal  information  regarding  the  group's  capabilities  and  intentions. 
Acquisition  of  such  documents  may  indicate  ties  to  another  country  if 
entry  or  unrestricted  travel  in  Panama  is  of  concern  to  the  group. 
They  may  also  signal  activities  related  to  narcotrafficking,  which 
relies  on  Panama  for  transshipment  and  money  laundering.  Knowledge 


21 


of  specific  documents  involved  may  also  assist  in  tracking 
organizational  personnel  and  predicting  a  probable  staging  area  for 
the  event. 

Training 

a.  What  suitable  sites  exist  for  training? 

sympathetic  or  at  least  tacitly  approving 
inhabitants 
rural,  remote,  secure 

level  of  training  offered  commensurate  with  group's 
suspected  capabilities 

b.  Have  gunfire,  explosions  or  other  unusual  activity 
been  reported? 

c.  Have  leaders  within/among  groups  increased 
communications/meetings? 

Training  Analysis 

Training  locations  depend  on  the  type  of  skills  that  are  taught 
and  the  level  of  popular  support  near  the  training  site.  Training  of 
large  groups  and  instruction  in  easily  detected  operations  such  as 
explosives  are  most  likely  to  occur  in  rural  or  remote  areas. 
Popular  support  is  also  an  important  factor  to  consider.  Densely 
settled  urban  areas  can  provide  secure  training  areas  when  the  local 
population  sympathizes  with  the  group's  objectives.  Popular  support 
in  rural  areas  decreases  the  chance  that  the  local  inhabitants  will 
report  the  group's  activities,  thus  impeding  detection  and  collection 
efforts. 

As  training  progresses  and  the  projected  date  of  the  event 
draws  near,  the  increased  pace  of  activity  may  lead  to  errors  that 
expose  the  operation  or  its  personnel.  Operational  rehearsals 
generally  require  dissemination  of  specific  information  to  the  lower 
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levels  of  the  group,  thus  increasing  the  risk  of  compromising  the 
operation. 

Discovery  of  surveillance  and  training  activities  may  indicate 
that  an  act  is  being  rehearsed,  and  may  also  reveal  the  type  of 
action  that  is  being  planned.  New  leaders  may  be  identified,  and 
estimates  of  the  group's  capabilities — including  the  size  of  the 
membership  and  the  skills  they  possess — may  be  revised. 

Staging 

a.  What  staging  areas  are  close  to/within  potential 
target  operational  areas? 

b.  Has  unusual  activity  been  observed  in/around  possible 
staging  bases? 

Movement  to  Target 

a.  Has  the  group  been  observed  departing  the  staging  area? 

b.  Has  the  group  been  observed  entering  the  operational 
area? 

Staging  and  Movement  to  Target  Analysis 

Once  the  indicators  for  target  selection,  logistical  support, 
and  training  are  detected,  the  analyst  can  then  narrow  the  search  for 
probable  staging  areas  and  movement  to  target.  Locations  close  to 
the  probable  target's  operational  area  can  be  surveilled  for  unusual 
activity. 

After  such  activity  becomes  apparent,  possibilities  for  active 
and  passive  countermeasures  may  be  initiated — to  include  threat 
warnings,  increased  security  in  the  target  area,  and  proactive 
operations. 
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3.  INCIDENT  PHASE 

a.  How  did  the  group  gain  access  to  the  target? 

independently  or  inside  connections 
sophisticated  surveillance  techniques 

b.  How  was  the  act  or  event  conducted? 

who,  what  when,  where,  why 

c.  What  was  the  final  resolution? 

escape  route  used 
punishment  or  interdiction 
popular  support  gained 
objectives  achieved 

Incident  Phase  Analysis 

In  addition  to  explaining  the  event  after  it  has  transpired, 
the  analysis  of  this  phase  is  an  important  source  of  new  information 
for  predicting  future  events. 

The  method  used  to  gain  access  to  the  target  depends  on  how 
well  the  target  is  protected.  Penetrating  well  protected  targets 
usually  requires  sophisticated  techniques  and  careful  planning.  The 
analyst  should  determine  wheth  r  inside  help  was  needed,  or  if  the 
group  was  able  to  operate  independently.  Recommendations  to  improve 
security  in  the  future  can  then  be  formulated  to  deter  future  such 
attacks,  or  force  groups  to  switch  targets  and  tactics. 

The  target  and  tactics  also  reflect  the  group's  objectives  and 
audience.  The  analyst  should  evaluate  the  target  of  the  event,  the 
audience  to  be  influenced,  and  the  tactics  used  to  determine  how  well 
they  supported  the  group's  objectives.  Since  the  stated  goals  and 
actual  goals  of  the  group  may  differ,  an  evaluation  of  the  target  and 
tactics  may  assist  the  analyst  in  determining  the  organization's  true 
intentions. 
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Finally,  the  analyst  mast  examine  the  resolution  of  the  event 
to  further  evaluate  the  group's  capabilities  and  intentions.  The 
weapons  or  explosives  used,  for  example,  obviously  indicate  the 
group's  capabilities,  but  may  also  reveal  ties  to  outside  states  or 
other  organizations  based  on  the  origin  and  type  of  material  used. 

The  analyst  should  also  pay  close  attention  to  how  the  event 
was  resolved.  Tf  arrests  occurred  during  a  demonstration,  for 
example,  it  is  important  to  note  who  was  bailed  out  first  and  by 
whom.  Such  information  may  indicate  the  leadors  of  the  group,  as 
well  as  any  ties  to  other  organizations.  Group  characteristics  may 
also  be  revealed  during  this  phase.  Extremist  group  members,  for 
example,  may  be  willing  to  martyr  themselves  or  serve  long  prison 
terms  in  support  of  their  cause. 

iJLiially,  the  analyst  must  consider  the  impact  of  the  event  on 
the  likelihood  of  future  acts.  Were  the  group's  tactical  or 
strategic  objectives  achieved?  Were  any  group  members  arrested?  Was 
the  security  of  the  organization  compromised?  Did  the  group  gain 
popular  support?  Did  the  government  security  forces  fail  to  detect 
and  foil  the  plan?  Such  factors  indicate  the  probability  of  future 
events  and  should  be  evaluated  in  this  phase  of  analysis. 

4.  POST-INCIDENT  PHASE  ANALYSIS 

The  post- incident  phase  comprises  the  link  between  the 
predictive  and  analytical  functions  of  the  model.  After  an  event  has 
occurred,  the  analyst  compares  what  actually  occurred  with  what  was 
predicted  to  happen.  Resulting  disparities  must  be  resolved  by 
reassessing  previous  assumptions,  searching  for  further  information, 
or  adjusting  the  model.  For  example,  if  a  certain  act  does  not  seem 


25 


to  support  a  group's  objectives,  the  analyst  must  decide  whether  the 
objectives  have  changed  or  were  just  evaluated  incorrectly.  The 
group  may  have  a  new  leader,  or  have  acquired  new  capabilities.  If 
disparities  have  led  the  analyst  to  modify  the  model,  then  all 
previous  judgments  concerning  the  group's  objectives  and  capabilities 
must  be  reformulated  in  terms  of  the  adjusted  framework.  Once  any 
discrepancies  have  been  resolved,  the  information  is  then  rechanneled 
through  the  model. 

The  cycle  continues  as  all  available  information  is 
reassimilated,  beginning  with  the  organizational  phase.  Any  missing 
information  should  then  drive  new  collection  requirements  to  fill  in 
the  gaps.  When  all  available  information  has  been  collected  and 
analyzed,  the  model  can  then  be  used  to  explain  what  has  happened  and 
why,  in  terms  of  the  group's  objectives  and  capabilities,  and  serve 
as  a  basis  for  predicting  future  threats. 

Finally,  most  acts  or  events  will  also  affect  the  economic, 
political,  and  social  determinants  of  instability  previously 
discussed,  thus  modifying  the  environment  in  which  intelligence  is 
collected  and  analyzed.  Therefore,  these  determinants  must  also  be 
reevaluated  in  light  of  changing  conditions  and  new  information. 
This  step  completes  the  cycle  and  enables  the  analyst  to  formulate 
new  collection  requirements,  analyze  new  information,  and  develop 
logical  assessments  of  the  threat  posed  to  the  Panamanian  government 
and  US  interests  in  Panama. 


